src/modules/extra/m_ssl_openssl.cpp

   1 /*
   2  * InspIRCd -- Internet Relay Chat Daemon
   3  *
   4  *   Copyright (C) 2009-2010 Daniel De Graaf <danieldg@inspircd.org>
   5  *   Copyright (C) 2008 Pippijn van Steenhoven <pip88nl@gmail.com>
   6  *   Copyright (C) 2006-2008 Craig Edwards <craigedwards@brainbox.cc>
   7  *   Copyright (C) 2008 Thomas Stagner <aquanight@inspircd.org>
   8  *   Copyright (C) 2007 Dennis Friis <peavey@inspircd.org>
   9  *   Copyright (C) 2006 Oliver Lupton <oliverlupton@gmail.com>
  10  *
  11  * This file is part of InspIRCd.  InspIRCd is free software: you can
  12  * redistribute it and/or modify it under the terms of the GNU General Public
  13  * License as published by the Free Software Foundation, version 2.
  14  *
  15  * This program is distributed in the hope that it will be useful, but WITHOUT
  16  * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
  17  * FOR A PARTICULAR PURPOSE.  See the GNU General Public License for more
  18  * details.
  19  *
  20  * You should have received a copy of the GNU General Public License
  21  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  22  */
  23
  24  /* HACK: This prevents OpenSSL on OS X 10.7 and later from spewing deprecation
  25   * warnings for every single function call. As far as I (SaberUK) know, Apple
  26   * have no plans to remove OpenSSL so this warning just causes needless spam.
  27   */
  28 #ifdef __APPLE__
  29 # define __AVAILABILITYMACROS__
  30 # define DEPRECATED_IN_MAC_OS_X_VERSION_10_7_AND_LATER
  31 #endif
  32
  33 #include "inspircd.h"
  34 #include "iohook.h"
  35 #include <openssl/ssl.h>
  36 #include <openssl/err.h>
  37 #include "modules/ssl.h"
  38
  39 #ifdef _WIN32
  40 # pragma comment(lib, "libcrypto.lib")
  41 # pragma comment(lib, "libssl.lib")
  42 # pragma comment(lib, "user32.lib")
  43 # pragma comment(lib, "advapi32.lib")
  44 # pragma comment(lib, "libgcc.lib")
  45 # pragma comment(lib, "libmingwex.lib")
  46 # pragma comment(lib, "gdi32.lib")
  47 # undef MAX_DESCRIPTORS
  48 # define MAX_DESCRIPTORS 10000
  49 #endif
  50
  51 /* $CompileFlags: pkgconfversion("openssl","0.9.7") pkgconfincludes("openssl","/openssl/ssl.h","") -Wno-pedantic */
  52 /* $LinkerFlags: rpath("pkg-config --libs openssl") pkgconflibs("openssl","/libssl.so","-lssl -lcrypto") */
  53
  54 enum issl_status { ISSL_NONE, ISSL_HANDSHAKING, ISSL_OPEN };
  55
  56 static bool SelfSigned = false;
  57
  58 char* get_error()
  59 {
  60         return ERR_error_string(ERR_get_error(), NULL);
  61 }
  62
  63 static int error_callback(const char *str, size_t len, void *u);
  64
  65 /** Represents an SSL user's extra data
  66  */
  67 class issl_session
  68 {
  69 public:
  70         SSL* sess;
  71         issl_status status;
  72         reference<ssl_cert> cert;
  73
  74         bool outbound;
  75         bool data_to_write;
  76
  77         issl_session()
  78         {
  79                 outbound = false;
  80                 data_to_write = false;
  81         }
  82 };
  83
  84 static int OnVerify(int preverify_ok, X509_STORE_CTX *ctx)
  85 {
  86         /* XXX: This will allow self signed certificates.
  87          * In the future if we want an option to not allow this,
  88          * we can just return preverify_ok here, and openssl
  89          * will boot off self-signed and invalid peer certs.
  90          */
  91         int ve = X509_STORE_CTX_get_error(ctx);
  92
  93         SelfSigned = (ve == X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT);
  94
  95         return 1;
  96 }
  97
  98 class OpenSSLIOHook : public SSLIOHook
  99 {
 100  private:
 101         bool Handshake(StreamSocket* user, issl_session* session)
 102         {
 103                 int ret;
 104
 105                 if (session->outbound)
 106                         ret = SSL_connect(session->sess);
 107                 else
 108                         ret = SSL_accept(session->sess);
 109
 110                 if (ret < 0)
 111                 {
 112                         int err = SSL_get_error(session->sess, ret);
 113
 114                         if (err == SSL_ERROR_WANT_READ)
 115                         {
 116                                 ServerInstance->SE->ChangeEventMask(user, FD_WANT_POLL_READ | FD_WANT_NO_WRITE);
 117                                 session->status = ISSL_HANDSHAKING;
 118                                 return true;
 119                         }
 120                         else if (err == SSL_ERROR_WANT_WRITE)
 121                         {
 122                                 ServerInstance->SE->ChangeEventMask(user, FD_WANT_NO_READ | FD_WANT_SINGLE_WRITE);
 123                                 session->status = ISSL_HANDSHAKING;
 124                                 return true;
 125                         }
 126                         else
 127                         {
 128                                 CloseSession(session);
 129                         }
 130
 131                         return false;
 132                 }
 133                 else if (ret > 0)
 134                 {
 135                         // Handshake complete.
 136                         VerifyCertificate(session, user);
 137
 138                         session->status = ISSL_OPEN;
 139
 140                         ServerInstance->SE->ChangeEventMask(user, FD_WANT_POLL_READ | FD_WANT_NO_WRITE | FD_ADD_TRIAL_WRITE);
 141
 142                         return true;
 143                 }
 144                 else if (ret == 0)
 145                 {
 146                         CloseSession(session);
 147                         return true;
 148                 }
 149
 150                 return true;
 151         }
 152
 153         void CloseSession(issl_session* session)
 154         {
 155                 if (session->sess)
 156                 {
 157                         SSL_shutdown(session->sess);
 158                         SSL_free(session->sess);
 159                 }
 160
 161                 session->sess = NULL;
 162                 session->status = ISSL_NONE;
 163                 errno = EIO;
 164         }
 165
 166         void VerifyCertificate(issl_session* session, StreamSocket* user)
 167         {
 168                 if (!session->sess || !user)
 169                         return;
 170
 171                 X509* cert;
 172                 ssl_cert* certinfo = new ssl_cert;
 173                 session->cert = certinfo;
 174                 unsigned int n;
 175                 unsigned char md[EVP_MAX_MD_SIZE];
 176
 177                 cert = SSL_get_peer_certificate((SSL*)session->sess);
 178
 179                 if (!cert)
 180                 {
 181                         certinfo->error = "Could not get peer certificate: "+std::string(get_error());
 182                         return;
 183                 }
 184
 185                 certinfo->invalid = (SSL_get_verify_result(session->sess) != X509_V_OK);
 186
 187                 if (!SelfSigned)
 188                 {
 189                         certinfo->unknownsigner = false;
 190                         certinfo->trusted = true;
 191                 }
 192                 else
 193                 {
 194                         certinfo->unknownsigner = true;
 195                         certinfo->trusted = false;
 196                 }
 197
 198                 certinfo->dn = X509_NAME_oneline(X509_get_subject_name(cert),0,0);
 199                 certinfo->issuer = X509_NAME_oneline(X509_get_issuer_name(cert),0,0);
 200
 201                 if (!X509_digest(cert, digest, md, &n))
 202                 {
 203                         certinfo->error = "Out of memory generating fingerprint";
 204                 }
 205                 else
 206                 {
 207                         certinfo->fingerprint = BinToHex(md, n);
 208                 }
 209
 210                 if ((ASN1_UTCTIME_cmp_time_t(X509_get_notAfter(cert), ServerInstance->Time()) == -1) || (ASN1_UTCTIME_cmp_time_t(X509_get_notBefore(cert), ServerInstance->Time()) == 0))
 211                 {
 212                         certinfo->error = "Not activated, or expired certificate";
 213                 }
 214
 215                 X509_free(cert);
 216         }
 217
 218  public:
 219         issl_session* sessions;
 220         SSL_CTX* ctx;
 221         SSL_CTX* clictx;
 222         const EVP_MD *digest;
 223
 224         OpenSSLIOHook(Module* mod)
 225                 : SSLIOHook(mod, "ssl/openssl")
 226         {
 227                 sessions = new issl_session[ServerInstance->SE->GetMaxFds()];
 228         }
 229
 230         ~OpenSSLIOHook()
 231         {
 232                 delete[] sessions;
 233         }
 234
 235         void OnStreamSocketAccept(StreamSocket* user, irc::sockets::sockaddrs* client, irc::sockets::sockaddrs* server) CXX11_OVERRIDE
 236         {
 237                 int fd = user->GetFd();
 238
 239                 issl_session* session = &sessions[fd];
 240
 241                 session->sess = SSL_new(ctx);
 242                 session->status = ISSL_NONE;
 243                 session->outbound = false;
 244                 session->cert = NULL;
 245
 246                 if (session->sess == NULL)
 247                         return;
 248
 249                 if (SSL_set_fd(session->sess, fd) == 0)
 250                 {
 251                         ServerInstance->Logs->Log(MODNAME, LOG_DEBUG, "BUG: Can't set fd with SSL_set_fd: %d", fd);
 252                         return;
 253                 }
 254
 255                 Handshake(user, session);
 256         }
 257
 258         void OnStreamSocketConnect(StreamSocket* user) CXX11_OVERRIDE
 259         {
 260                 int fd = user->GetFd();
 261                 /* Are there any possibilities of an out of range fd? Hope not, but lets be paranoid */
 262                 if ((fd < 0) || (fd > ServerInstance->SE->GetMaxFds() -1))
 263                         return;
 264
 265                 issl_session* session = &sessions[fd];
 266
 267                 session->sess = SSL_new(clictx);
 268                 session->status = ISSL_NONE;
 269                 session->outbound = true;
 270
 271                 if (session->sess == NULL)
 272                         return;
 273
 274                 if (SSL_set_fd(session->sess, fd) == 0)
 275                 {
 276                         ServerInstance->Logs->Log(MODNAME, LOG_DEBUG, "BUG: Can't set fd with SSL_set_fd: %d", fd);
 277                         return;
 278                 }
 279
 280                 Handshake(user, session);
 281         }
 282
 283         void OnStreamSocketClose(StreamSocket* user) CXX11_OVERRIDE
 284         {
 285                 int fd = user->GetFd();
 286                 /* Are there any possibilities of an out of range fd? Hope not, but lets be paranoid */
 287                 if ((fd < 0) || (fd > ServerInstance->SE->GetMaxFds() - 1))
 288                         return;
 289
 290                 CloseSession(&sessions[fd]);
 291         }
 292
 293         int OnStreamSocketRead(StreamSocket* user, std::string& recvq) CXX11_OVERRIDE
 294         {
 295                 int fd = user->GetFd();
 296                 /* Are there any possibilities of an out of range fd? Hope not, but lets be paranoid */
 297                 if ((fd < 0) || (fd > ServerInstance->SE->GetMaxFds() - 1))
 298                         return -1;
 299
 300                 issl_session* session = &sessions[fd];
 301
 302                 if (!session->sess)
 303                 {
 304                         CloseSession(session);
 305                         return -1;
 306                 }
 307
 308                 if (session->status == ISSL_HANDSHAKING)
 309                 {
 310                         // The handshake isn't finished and it wants to read, try to finish it.
 311                         if (!Handshake(user, session))
 312                         {
 313                                 // Couldn't resume handshake.
 314                                 if (session->status == ISSL_NONE)
 315                                         return -1;
 316                                 return 0;
 317                         }
 318                 }
 319
 320                 // If we resumed the handshake then session->status will be ISSL_OPEN
 321
 322                 if (session->status == ISSL_OPEN)
 323                 {
 324                         char* buffer = ServerInstance->GetReadBuffer();
 325                         size_t bufsiz = ServerInstance->Config->NetBufferSize;
 326                         int ret = SSL_read(session->sess, buffer, bufsiz);
 327
 328                         if (ret > 0)
 329                         {
 330                                 recvq.append(buffer, ret);
 331                                 if (session->data_to_write)
 332                                         ServerInstance->SE->ChangeEventMask(user, FD_WANT_POLL_READ | FD_WANT_SINGLE_WRITE);
 333                                 return 1;
 334                         }
 335                         else if (ret == 0)
 336                         {
 337                                 // Client closed connection.
 338                                 CloseSession(session);
 339                                 user->SetError("Connection closed");
 340                                 return -1;
 341                         }
 342                         else if (ret < 0)
 343                         {
 344                                 int err = SSL_get_error(session->sess, ret);
 345
 346                                 if (err == SSL_ERROR_WANT_READ)
 347                                 {
 348                                         ServerInstance->SE->ChangeEventMask(user, FD_WANT_POLL_READ);
 349                                         return 0;
 350                                 }
 351                                 else if (err == SSL_ERROR_WANT_WRITE)
 352                                 {
 353                                         ServerInstance->SE->ChangeEventMask(user, FD_WANT_NO_READ | FD_WANT_SINGLE_WRITE);
 354                                         return 0;
 355                                 }
 356                                 else
 357                                 {
 358                                         CloseSession(session);
 359                                         return -1;
 360                                 }
 361                         }
 362                 }
 363
 364                 return 0;
 365         }
 366
 367         int OnStreamSocketWrite(StreamSocket* user, std::string& buffer) CXX11_OVERRIDE
 368         {
 369                 int fd = user->GetFd();
 370
 371                 issl_session* session = &sessions[fd];
 372
 373                 if (!session->sess)
 374                 {
 375                         CloseSession(session);
 376                         return -1;
 377                 }
 378
 379                 session->data_to_write = true;
 380
 381                 if (session->status == ISSL_HANDSHAKING)
 382                 {
 383                         if (!Handshake(user, session))
 384                         {
 385                                 // Couldn't resume handshake.
 386                                 if (session->status == ISSL_NONE)
 387                                         return -1;
 388                                 return 0;
 389                         }
 390                 }
 391
 392                 if (session->status == ISSL_OPEN)
 393                 {
 394                         int ret = SSL_write(session->sess, buffer.data(), buffer.size());
 395                         if (ret == (int)buffer.length())
 396                         {
 397                                 session->data_to_write = false;
 398                                 ServerInstance->SE->ChangeEventMask(user, FD_WANT_POLL_READ | FD_WANT_NO_WRITE);
 399                                 return 1;
 400                         }
 401                         else if (ret > 0)
 402                         {
 403                                 buffer = buffer.substr(ret);
 404                                 ServerInstance->SE->ChangeEventMask(user, FD_WANT_SINGLE_WRITE);
 405                                 return 0;
 406                         }
 407                         else if (ret == 0)
 408                         {
 409                                 CloseSession(session);
 410                                 return -1;
 411                         }
 412                         else if (ret < 0)
 413                         {
 414                                 int err = SSL_get_error(session->sess, ret);
 415
 416                                 if (err == SSL_ERROR_WANT_WRITE)
 417                                 {
 418                                         ServerInstance->SE->ChangeEventMask(user, FD_WANT_SINGLE_WRITE);
 419                                         return 0;
 420                                 }
 421                                 else if (err == SSL_ERROR_WANT_READ)
 422                                 {
 423                                         ServerInstance->SE->ChangeEventMask(user, FD_WANT_POLL_READ);
 424                                         return 0;
 425                                 }
 426                                 else
 427                                 {
 428                                         CloseSession(session);
 429                                         return -1;
 430                                 }
 431                         }
 432                 }
 433                 return 0;
 434         }
 435
 436         ssl_cert* GetCertificate(StreamSocket* sock) CXX11_OVERRIDE
 437         {
 438                 int fd = sock->GetFd();
 439                 issl_session* session = &sessions[fd];
 440                 return session->cert;
 441         }
 442
 443         void TellCiphersAndFingerprint(LocalUser* user)
 444         {
 445                 issl_session& s = sessions[user->eh.GetFd()];
 446                 if (s.sess)
 447                 {
 448                         std::string text = "*** You are connected using SSL cipher '" + std::string(SSL_get_cipher(s.sess)) + "'";
 449                         const std::string& fingerprint = s.cert->fingerprint;
 450                         if (!fingerprint.empty())
 451                                 text += " and your SSL fingerprint is " + fingerprint;
 452
 453                         user->WriteNotice(text);
 454                 }
 455         }
 456 };
 457
 458 class ModuleSSLOpenSSL : public Module
 459 {
 460         std::string sslports;
 461         OpenSSLIOHook iohook;
 462
 463  public:
 464         ModuleSSLOpenSSL() : iohook(this)
 465         {
 466                 /* Global SSL library initialization*/
 467                 SSL_library_init();
 468                 SSL_load_error_strings();
 469
 470                 /* Build our SSL contexts:
 471                  * NOTE: OpenSSL makes us have two contexts, one for servers and one for clients. ICK.
 472                  */
 473                 iohook.ctx = SSL_CTX_new( SSLv23_server_method() );
 474                 iohook.clictx = SSL_CTX_new( SSLv23_client_method() );
 475
 476                 SSL_CTX_set_mode(iohook.ctx, SSL_MODE_ENABLE_PARTIAL_WRITE | SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER);
 477                 SSL_CTX_set_mode(iohook.clictx, SSL_MODE_ENABLE_PARTIAL_WRITE | SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER);
 478
 479                 SSL_CTX_set_verify(iohook.ctx, SSL_VERIFY_PEER | SSL_VERIFY_CLIENT_ONCE, OnVerify);
 480                 SSL_CTX_set_verify(iohook.clictx, SSL_VERIFY_PEER | SSL_VERIFY_CLIENT_ONCE, OnVerify);
 481         }
 482
 483         ~ModuleSSLOpenSSL()
 484         {
 485                 SSL_CTX_free(iohook.ctx);
 486                 SSL_CTX_free(iohook.clictx);
 487         }
 488
 489         void init() CXX11_OVERRIDE
 490         {
 491                 // Needs the flag as it ignores a plain /rehash
 492                 OnModuleRehash(NULL,"ssl");
 493                 ServerInstance->Modules->AddService(iohook);
 494         }
 495
 496         void OnHookIO(StreamSocket* user, ListenSocket* lsb) CXX11_OVERRIDE
 497         {
 498                 if (!user->GetIOHook() && lsb->bind_tag->getString("ssl") == "openssl")
 499                 {
 500                         /* Hook the user with our module */
 501                         user->AddIOHook(&iohook);
 502                 }
 503         }
 504
 505         void OnRehash(User* user) CXX11_OVERRIDE
 506         {
 507                 sslports.clear();
 508
 509                 ConfigTag* Conf = ServerInstance->Config->ConfValue("openssl");
 510
 511                 if (Conf->getBool("showports", true))
 512                 {
 513                         sslports = Conf->getString("advertisedports");
 514                         if (!sslports.empty())
 515                                 return;
 516
 517                         for (size_t i = 0; i < ServerInstance->ports.size(); i++)
 518                         {
 519                                 ListenSocket* port = ServerInstance->ports[i];
 520                                 if (port->bind_tag->getString("ssl") != "openssl")
 521                                         continue;
 522
 523                                 const std::string& portid = port->bind_desc;
 524                                 ServerInstance->Logs->Log(MODNAME, LOG_DEFAULT, "Enabling SSL for port %s", portid.c_str());
 525
 526                                 if (port->bind_tag->getString("type", "clients") == "clients" && port->bind_addr != "127.0.0.1")
 527                                 {
 528                                         /*
 529                                          * Found an SSL port for clients that is not bound to 127.0.0.1 and handled by us, display
 530                                          * the IP:port in ISUPPORT.
 531                                          *
 532                                          * We used to advertise all ports seperated by a ';' char that matched the above criteria,
 533                                          * but this resulted in too long ISUPPORT lines if there were lots of ports to be displayed.
 534                                          * To solve this by default we now only display the first IP:port found and let the user
 535                                          * configure the exact value for the 005 token, if necessary.
 536                                          */
 537                                         sslports = portid;
 538                                         break;
 539                                 }
 540                         }
 541                 }
 542         }
 543
 544         void OnModuleRehash(User* user, const std::string &param) CXX11_OVERRIDE
 545         {
 546                 if (param != "ssl")
 547                         return;
 548
 549                 std::string keyfile;
 550                 std::string certfile;
 551                 std::string cafile;
 552                 std::string dhfile;
 553                 OnRehash(user);
 554
 555                 ConfigTag* conf = ServerInstance->Config->ConfValue("openssl");
 556
 557                 cafile   = ServerInstance->Config->Paths.PrependConfig(conf->getString("cafile", "ca.pem"));
 558                 certfile = ServerInstance->Config->Paths.PrependConfig(conf->getString("certfile", "cert.pem"));
 559                 keyfile  = ServerInstance->Config->Paths.PrependConfig(conf->getString("keyfile", "key.pem"));
 560                 dhfile   = ServerInstance->Config->Paths.PrependConfig(conf->getString("dhfile", "dhparams.pem"));
 561                 std::string hash = conf->getString("hash", "md5");
 562
 563                 iohook.digest = EVP_get_digestbyname(hash.c_str());
 564                 if (iohook.digest == NULL)
 565                         throw ModuleException("Unknown hash type " + hash);
 566
 567                 std::string ciphers = conf->getString("ciphers", "");
 568
 569                 SSL_CTX* ctx = iohook.ctx;
 570                 SSL_CTX* clictx = iohook.clictx;
 571
 572                 if (!ciphers.empty())
 573                 {
 574                         if ((!SSL_CTX_set_cipher_list(ctx, ciphers.c_str())) || (!SSL_CTX_set_cipher_list(clictx, ciphers.c_str())))
 575                         {
 576                                 ServerInstance->Logs->Log(MODNAME, LOG_DEFAULT, "Can't set cipher list to %s.", ciphers.c_str());
 577                                 ERR_print_errors_cb(error_callback, this);
 578                         }
 579                 }
 580
 581                 /* Load our keys and certificates
 582                  * NOTE: OpenSSL's error logging API sucks, don't blame us for this clusterfuck.
 583                  */
 584                 if ((!SSL_CTX_use_certificate_chain_file(ctx, certfile.c_str())) || (!SSL_CTX_use_certificate_chain_file(clictx, certfile.c_str())))
 585                 {
 586                         ServerInstance->Logs->Log(MODNAME, LOG_DEFAULT, "Can't read certificate file %s. %s", certfile.c_str(), strerror(errno));
 587                         ERR_print_errors_cb(error_callback, this);
 588                 }
 589
 590                 if (((!SSL_CTX_use_PrivateKey_file(ctx, keyfile.c_str(), SSL_FILETYPE_PEM))) || (!SSL_CTX_use_PrivateKey_file(clictx, keyfile.c_str(), SSL_FILETYPE_PEM)))
 591                 {
 592                         ServerInstance->Logs->Log(MODNAME, LOG_DEFAULT, "Can't read key file %s. %s", keyfile.c_str(), strerror(errno));
 593                         ERR_print_errors_cb(error_callback, this);
 594                 }
 595
 596                 /* Load the CAs we trust*/
 597                 if (((!SSL_CTX_load_verify_locations(ctx, cafile.c_str(), 0))) || (!SSL_CTX_load_verify_locations(clictx, cafile.c_str(), 0)))
 598                 {
 599                         ServerInstance->Logs->Log(MODNAME, LOG_DEFAULT, "Can't read CA list from %s. This is only a problem if you want to verify client certificates, otherwise it's safe to ignore this message. Error: %s", cafile.c_str(), strerror(errno));
 600                         ERR_print_errors_cb(error_callback, this);
 601                 }
 602
 603                 FILE* dhpfile = fopen(dhfile.c_str(), "r");
 604                 DH* ret;
 605
 606                 if (dhpfile == NULL)
 607                 {
 608                         ServerInstance->Logs->Log(MODNAME, LOG_DEFAULT, "Couldn't open DH file %s: %s", dhfile.c_str(), strerror(errno));
 609                         throw ModuleException("Couldn't open DH file " + dhfile + ": " + strerror(errno));
 610                 }
 611                 else
 612                 {
 613                         ret = PEM_read_DHparams(dhpfile, NULL, NULL, NULL);
 614                         if ((SSL_CTX_set_tmp_dh(ctx, ret) < 0) || (SSL_CTX_set_tmp_dh(clictx, ret) < 0))
 615                         {
 616                                 ServerInstance->Logs->Log(MODNAME, LOG_DEFAULT, "Couldn't set DH parameters %s. SSL errors follow:", dhfile.c_str());
 617                                 ERR_print_errors_cb(error_callback, this);
 618                         }
 619                 }
 620
 621                 fclose(dhpfile);
 622         }
 623
 624         void On005Numeric(std::map<std::string, std::string>& tokens) CXX11_OVERRIDE
 625         {
 626                 if (!sslports.empty())
 627                         tokens["SSL"] = sslports;
 628         }
 629
 630         void OnUserConnect(LocalUser* user) CXX11_OVERRIDE
 631         {
 632                 if (user->eh.GetIOHook() == &iohook)
 633                         iohook.TellCiphersAndFingerprint(user);
 634         }
 635
 636         void OnCleanup(int target_type, void* item) CXX11_OVERRIDE
 637         {
 638                 if (target_type == TYPE_USER)
 639                 {
 640                         LocalUser* user = IS_LOCAL((User*)item);
 641
 642                         if (user && user->eh.GetIOHook() == &iohook)
 643                         {
 644                                 // User is using SSL, they're a local user, and they're using one of *our* SSL ports.
 645                                 // Potentially there could be multiple SSL modules loaded at once on different ports.
 646                                 ServerInstance->Users->QuitUser(user, "SSL module unloading");
 647                         }
 648                 }
 649         }
 650
 651         Version GetVersion() CXX11_OVERRIDE
 652         {
 653                 return Version("Provides SSL support for clients", VF_VENDOR);
 654         }
 655 };
 656
 657 static int error_callback(const char *str, size_t len, void *u)
 658 {
 659         ServerInstance->Logs->Log(MODNAME, LOG_DEFAULT, "SSL error: " + std::string(str, len - 1));
 660
 661         //
 662         // XXX: Remove this line, it causes valgrind warnings...
 663         //
 664         // MD_update(&m, buf, j);
 665         //
 666         //
 667         // ... ONLY JOKING! :-)
 668         //
 669
 670         return 0;
 671 }
 672
 673 MODULE_INIT(ModuleSSLOpenSSL)